Our Blog

Abusing Windows’ tokens to compromise Active Directory without touching LSASS

Reading time: ~34 min
During an internal assessment, I performed an NTLM relay and ended up owning the NT AUTHORITY\SYSTEM account of the Windows...